Cyber-Attacks: Is It Really Not If You Will Be Attacked, But When? is my new column in the Oklahoma Bar Journal.

This is a sobering subject, but it is critical for all law firms to appreciate this idea in their risk management practices. It is a bit hard to accept that it may be impossible to have such bulletproof cyber security that you can be absolutely confident you will never be breached. After all, I’m fairly certain our country’s intelligence services had some Skull and crossbones high level experts working on their security and they have suffered spectacular  breaches.  In hindsight, this article’s title perhaps should have been “Manage Cyber-Attacks: Is It Really Not If You Will Be Compromised, But When?”

We have fallible, and sometimes corruptible, human beings working with our technology systems. Computer code is vastly more complex. There are more openings. Think of the difference between fighting crime in a small town with one stop light and a large urban metropolis with high rise buildings, subway systems, subterranean sewers and other complex infrastructure.  Coders are going to write new code. Some of it will have unintended consequences and open up new security risks. And that new employee may not appreciate all of the dangers lurking in her inbox.

So does that mean give up? Game over?

Of course not, we cannot give up on security measures. We need to have good cyber-security infrastructure,  practices and training. But there will be dangers appearing online that haven’t been invented yet.

Today, a large part of good security practices includes creating Incident Response Plans and other recovery techniques. If you do not have an IRP, it is time to create one. This is unpleasant to consider and easy to procrastinate for the same reason so many people put off creating an estate plan. But this is just as important.

In the column, I take the reader through a couple of scenarios to give some examples of planning. Firms can get help with IRP’s from professionals, but each plan should be unique because the assets you have to respond are unique. I tried not to make this too threatening, but I have been on the phone with lawyers who had no plan and now have a network frozen by some malware. Planning is better!

 

Most law firms maintain a brief bank or forms library. Operating from prior work as a starting place has been a long-established work practice in many workplaces. As I previously noted in my Law Practice Magazine column Your Document Czar (July/August 2015), the way law firms produce Gold standard documentdocuments is evolving as document assembly tools enter the workplace. We also can appreciate some risk with using “the last time we did this” as a starting point instead of using an established best practice starting point.

Whether you’re going to automate the creation process or manually generate a document, every lawyer in every law firm should be operating from a flawless standard starting point. I’m far from alone in noting that law firms should invest in creating “gold standard documents” as this common starting place for the lawyers in the firm.

Certainly there will be a continuing need for handcrafted and unique pleadings, briefs, contracts and other legal documents. But many of these creations may be improved if the drafter always starts from a gold standard. When we talk about the future of law, Implementing the Gold Standard, the subject of my column in the May/June 2017 issue of Law Practice Magazine, is a common sense practice for law firms.

No matter what your view of the future, this is an important practice for your law today as well as for the future. What policies do you have in place to make certain your unique documents being created now are preserved as a future gold standard?

There's a lot of discussion these days about Artificial Intelligence and how AI and robots are replacing many jobs. Lawyers are starting to listen and think about how this trend might impact them. For the near future, most of those who pay attention to such trends in legal tech generally say it won't necessarily be technology replacing lawyers so much as lawyers who are more Andrew Arrudaempowered by technology replacing those who want to do things the old, traditional way.

In this episode of The Digital Edge Podcast – Running with the Machines: Artificial Intelligence in the Practice of Law, hosts Jim Calloway and Sharon Nelson talk to Andrew Arruda, Chief Executive Officer and Co-Founder of the artificial intelligence company ROSS Intelligence, about how artificial intelligence assists lawyers, not replaces them. Our conversation includes what ROSS is, the biggest misconceptions surrounding AI, and the biggest challenges facing legal technology adoption in larger firms. In case you have not be paying any attention, ROSS is the legal version of Watson, IBM's AI tool that is famous for easily beating the best Jeopardy human champions.

Don't dismiss this podcast because you are unconcerned about AI. Understanding the next generation of tools that are making their way into law firms is important for every lawyer even if you have no intention of hiring ROSS as your new associate.

PortalIt is not exaggerating to say that for most lawyers, providing clients with a client portal is a critically important topic. The idea of using a client portal to better serve your clients involves more than better client service. This involves “best practices” for security of client information. Setting up a portal allows your firm to set up comprehensive processes for electronic transmission of confidential (and nonconfidential) information and it is generally a more user-friendly process than training a client on the use of encrypted email. It is an internal time-saving practice.

Client portals demonstrate to your clients that you are on top of recent technology trends regarding how confidential information should be treated and secure client portals help you ensure that you are observing your ethical obligations about handling sensitive material.

Many lawyers already have the technical capability for client portals provided within their practice management software solutions, but they haven’t taken the time to implement a firm-wide comprehensive policy on how these portals are used.

Others may use dedicated portal solutions provided by third parties. We will show examples of  both types of solutions. This practice obviously works differently for a large firm with an IT department versus a solo practitioner. We will focus on tools for medium-sized and small law firms, but the discussion of how to use client portals and why applies to every lawyer.

The genesis for this program was my most linked and most reprinted column of last year Email Attachments vs. Client Portals. Take a few moments to read that now if you missed it the first time to remind you of why you should attend this CLE program.

Apple bought the Workflow app last week–and they apparently do not plan to kill it. As an iPhone user who was always going to get around to trying Workflow, I now think big things are ahead for this app and a lot of lawyers may want to try this now-free app.

See Apple bought the best utility app for the iPhone, Workflow.  From a 2014 review: "With only a half-hour of familiarity I was able to Workflow appset up a workflow that can find the locations of meetings I might have on any given day, pull images of the buildings they're in from Google Street View, and email them all to me."

If you are new to workflows or process automation, probably the best way to understand this is to look through these examples: 25 Coolest Things Apple's Workflow App Can Do.  Number 4 is how to easily create those text-on-picture graphics we see circulating as social media memes using your own pictures and the text you want.

The above included several things I didn't know how to do, although I assumed that they were "doable" with some research. The list above has many fun and useful things to do on your iPhone, like automatically texting your spouse the time you will be home. But it is also good experience for lawyers as developing law office workflow automation is something lawyers will be doing more, so some experience is good.

There are also many good reviews of Workflow in the iTunes store.

It is the week of ABA TECHSHOW and a good way to get warmed up is to check out the TECHSHOW edition of Law Practice Magazine.

LPMAGMarch2017CoverThe cover story is A Golden Age of Legal Tech Start-Ups by Bob Ambrogi. Other features cover topics from legal incubators to e-signatures. Columns include my observations on Managing the Robots, Tom Mighell on the Battle of the Workplace Messaging Apps, Pete Roberts on A 'Periodic Table' of Law Firm Profitability for Small Firms and Sharon Nelson and John W. Simek on Securing Your Law Firm's Website: A Critical Cybersecurity Task.

If you think managing all of the lawyers and staff in a law firm is a challenge, just wait for that day (coming sooner than you think) when you also have to manage the robots working for your law firm. Despite the cool graphic the magazine production team found to illustrate Managing the Robots, I don’t think we are likely to see humanoid robots in law firms anytime soon. But I do think we are about to see more and more automated processes powered by smart technology systems. This brings up many challenges for firms that are used to supervising people as opposed to perfecting and managing automated processes.

Which partner or partners try to lay claim to the machine-generated profits will just be the first (and loudest) of these issues.

I hope to see you at ABA TECHSHOW this week.

 

Does quality writing really make you a better lawyer? On this episode of The Digital Edge, The Importance of Legal Writing, hosts Sharon Nelson and Jim Calloway discuss legal writing with Gary Kinder, founder of the editing program WordRake. Together, they explore lawyers’ biggest writing errors, why this is important in the  Gary Kinder courtroom, and how writing well can help build a positive reputation for a firm. In their conclusion of the episode, they shift the focus to WordRake itself, expanding on what it is, the cost, and why it’s effective. They even include a treat especially for Digital Edge listeners.

Gary Kinder founded the software company WordRake in 2012. The company’s eponymous software is an automated editing program that suggests changes to improve brevity and clarity.

On a personal note, I write a column, a CLE paper or a book chapter almost every week it seems, and consider myself a fairly accomplished writer. I always get some usable edits and suggestions from WordRake. You probably will, too. Enjoy your "free treat."

Robot and gavelThe idea for my column, Automation in Today’s Law Firm, came during a holiday evening in the Calloway household, when my spouse and I were setting up several automated tasks, none of which had anything to do with the Internet of Things.

There has been much discussion among futurists and technologists about how robots and artificial intelligence were moving on from taking the jobs of factory workers to threatening knowledge workers, like lawyers. Yet, some law firms have not implemented some simple and easy-to-use automation tools that are available today.

So Automation in Today’s Law Firm is about automation projects you can do today and, that some readers already have incorporated. I end with a few more sophisticated automation tools like IFTTT (If This Then That) and Zapier. These two are not widely in use in the legal profession, but definitely are in use in the legal profession.

Full-blown massive law office automation projects are beyond the scope of the column, but here is some additional reading on automation and artificial intelligence not included in the column:

Benefits and the Climb of Legal Automation by Sarah A. McCromick

Biglaw Automation: Whose Job Goes First? by Michael Allen

How artificial intelligence is transforming the legal profession by Julie Sobowale (ABA Journal April 2016 cover story)

Several hundred academic articles are available for free download at Vanderbilt law School’s Artificial Intelligence – Law, Policy, & Ethics eJournal on the Social Science Research Network (SSRN). Some provocative titles include Using Machine Learning to Predict Outcomes in Tax Law, Siri-ously 2.0: What Artificial Intelligence Reveals about the First Amendment , and for Issac Asimov fans, The Three Laws of Robotics in the Age of Big Data. My favorite title (even thought I didn’t read the paper) was Do Driverless Cars Dream of Electric Sheep?

Discussions about Alternative Business Structures (ABS) in law firms often produce a lot of spirited debates, especially when the proposals about this idea are discussed by American Bar Association entities. Generally ABS refers to various different ideas about non-lawyer ownership or management of law firms. Last year when the ABA Commission on the Future of Legal Services published an David Beech bio issues paper and solicited comments on ABS, various state bar associations and other lawyer organizations reacted strongly and filed comments opposing ABS. There was many colorful comments submitted by lawyers. For example, the ABA Family Law Section comment was “On behalf of the Section of Family Law, we pose the following question: WHAT PART OF “NO!” DO YOU NOT UNDERSTAND? We remain unalterably opposed to these repeated, previously failed efforts to foist ABS upon our profession or our ethics.”

It is easy to understand the concerns from the legal profession. The practice of law cannot ethically be just about profit-and-loss decision making. So there are concerns that a non-lawyer administrator might tell a lawyer to not do any more work on an matter with a critical hearing date approaching because the client’s retainer had been exhausted or tell a lawyer to unethically do more work on a matter where a solution was found relatively quickly with limited expense. But the negative reaction to ABS proposals is often so strong that one wonders if those responding have completely considered the potential benefits.

Our Digital Edge podcast this month is “Will Alternative Business Structures in U.K. Law Firms Cross the Pond?” It is instructive to listen to the story of a major U.K. law firm that has become an ABS, both how they undertook this path and why the lawyers are pleased that they did so. David Beech is the CEO of the professional services firm Knights in the U.K. David has led the business, originally a law firm, since 2011. His vision for Knights is to become the leading regional professional services business in the U.K. He was an outstanding podcast guest and this is a very worthwhile podcast.

If you are one of those lawyers who thinks this is a terrible idea, then that is all the more reason to listen to this podcast. You might learn something. Maybe you will learn of some benefits and changes your firm can incorporate without becoming an ABS. After all, it is not like the proponents of these changes want to allow for this to destroy the legal profession.

This week we learned of a new Gmail phishing attack that is sophisticated, ingenious and is going to compromise a lot of Gmail accounts. Read the Forbes story Phishing This Gmail Phishing Attack Is Fooling Even Savvy Users and then share either this blog post or that story with those you know who might be using GMail. (This would be great for your law firm to share via social media.)

As I noted, this one is very impressive. When they compromise a GMail account they instantly raid the account and then set up new phishing attacks coming from the compromised user’s account to people he/she has in their Contacts or Inbox. Since they have access to everything in your Gmail, they include a relevant subject line from an actual sent email to them as the subject line on the phishing email. Devilishly clever. Someone you have corresponded with gets an email from you with a subject line of a recent email discussion between you. The recipient understandably is more likely to click on the attachment and then enter the requested information.

You can read in Forbes about the clever trick they use to make the login appear legitimate by loading “a full web page worth of code into the browser’s address bar.”

I get these phishing emails all the time. Just yesterday members of an American Bar Association group I am a part of received an email with a “contract” from the ABA. The attachment appeared to be a normal PDF attachment, but luckily, as you can see below, the email was not that persuasive. ABA staff followed up quickly with a warning.

This story is appearing in the media. But I wanted to make sure you learned the main lesson from this. This one was too good. You can no longer be certain you won’t fall for one of these scams.

ABA scamThis is the strongest case you will find for using 2 factor authentication. If you have it set up on Gmail, this exploit accomplishes nothing because the bad guys don’t have your phone or fingerprint. And when you next regularly change your password, they will no longer have your password either. If you don’t have 2 factor authentication enabled, then they have access to your entire Google account, including Gmail (with perhaps receipts from your online shopping,) Google Wallet, documents you have stored in Google Drive, Google Calendar entries, photos in Google Photos and your YouTube account. What risk this entails to you depends on how you much you use Gmail or Google services.